Examkin

Soru

Zorluk: OrtaProvisioning Storage and Database Systems

A cloud platform team needs to deploy a Cloud SQL for PostgreSQL database instance with Private Services Access (PSA) and Customer-Managed Encryption Keys (CMEK). Arrange the operational steps in the correct order to provision this infrastructure successfully.

  1. 1Allocate an IP address range and establish a private VPC peering connection to the service networking network.
  2. 2Grant the Cloud SQL Service Agent account the Cloud KMS CryptoKey Encrypter/Decrypter role on the specified Key Ring.
  3. 3Provision the Cloud SQL instance configured with private IP networking and the CMEK key reference.
  4. 4Validate private network connectivity to the database instance from a workload inside the VPC network.

Cevap

The correct sequence begins with establishing Private Services Access, followed by granting IAM permissions for Cloud KMS to the Cloud SQL service agent, provisioning the CMEK-encrypted database instance over private IP, and concluding with database connectivity verification.
Provisioning database infrastructure with Private Services Access (PSA) and Customer-Managed Encryption Keys (CMEK) follows strict prerequisite ordering: network connectivity and IAM key permissions must exist before creating the dependent database instance, with post-provisioning connectivity checks executed last.

Adım Adım Çözüm

1
Allocate IP address ranges and configure Private Services Access VPC peering.
The VPC network is connected to Google service networking infrastructure.
Cloud SQL requires Private Services Access peering to assign private IP addresses within the VPC.
2
Assign roles/cloudkms.cryptoKeyEncrypterDecrypter to the Cloud SQL service account.
Cloud SQL service identity gains access rights to encrypt and decrypt using the specified Cloud KMS key.
Attempting to create a CMEK-enabled instance will fail at creation time if the service agent lacks KMS permissions.
3
Create the Cloud SQL instance specifying the private network connection and CMEK key URI.
The database instance is provisioned with customer-managed encryption and private IP networking.
This step relies on the pre-existing private network peering and encryption identity rights.
4
Verify database endpoint accessibility from authorized client instances in the VPC.
Operational readiness and network security controls are validated.
Testing private connectivity is the final validation phase of database provisioning.

Anahtar Kavram

Cloud SQL Provisioning Dependency Ordering with PSA and CMEK
Bu soruyu puanla

Konular

Provisioning Storage and Database Systems

Bu konudan daha fazla soru